Detections
Analytics

SCA: security update for github.com/zitadel/zitadel, github.com/zitadel/zitadel/v2 (GHSA-93m4-mfpg-c3xf)

high Tenable Cloud Security Plugin ID 434766

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Zitadel is open-source identity infrastructure software. Prior to versions 2.70.12, 2.71.10, and 3.2.2, a
 potential vulnerability exists in the password reset mechanism. ZITADEL utilizes the Forwarded or
 X-Forwarded-Host header from incoming requests to construct the URL for the password reset confirmation
 link. This link, containing a secret code, is then emailed to the user. If an attacker can manipulate
 these headers (e.g., via host header injection), they could cause ZITADEL to generate a password reset
 link pointing to a malicious domain controlled by the attacker. If the user clicks this manipulated link
 in the email, the secret reset code embedded in the URL can be captured by the attacker. This captured
 code could then be used to reset the user's password and gain unauthorized access to their account. This
 specific attack vector is mitigated for accounts that have Multi-Factor Authentication (MFA) or
 Passwordless authentication enabled. This issue has been patched in versions 2.70.12, 2.71.10, and 3.2.2.
 (CVE-2025-48936)

See Also

https://github.com/advisories/GHSA-93m4-mfpg-c3xf

Plugin Details

Severity: High

ID: 434766

Version: Revision 1.4

Type: Local

Family: SCA Checks

Published: 8/19/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 57.12

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 7.4

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2025-48936

CVSS v3

Risk Factor: High

Base Score: 8.8

Temporal Score: 7.7

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 5/28/2025

Vulnerability Publication Date: 5/28/2025

Reference Information

CVE: CVE-2025-48936

cwe: CWE-601